Fixed‑wing turbine
Retrofit into existing avionics over ARINC 429. The airframer keeps the type certificate; Northvane ships as a supplemental system with its own safety case.
- Airframes
- 8
- Status
- Flight test
- Authority
- Advisory
Autonomy a regulator can read.
We build the perception, decision and control stack for crewed and uncrewed aircraft — and the evidence trail that gets it certified.
ALT41 000ft
IAS448kt
HDG274°
MODEAUTO
An aircraft does not need software that is clever. It needs software that fails in ways you can predict, bound and prove.
Three layers, one contract between them.
Each layer publishes what it knows and what it does not. Nothing downstream ever has to guess, and nothing upstream can quietly change the deal.
-
Radar, EO/IR, ADS‑B and inertial resolve into a single world model at 200 Hz. Every track carries its own covariance, so the layers above it know exactly how much to trust it — and when to stop.
- Rate
- 200 Hz
- Sensor classes
- 4
- Track state
- Position, velocity, covariance
-
Routes are checked against aircraft performance, terrain, weather and airspace before they are ever offered. A plan that cannot be flown is never shown to the crew, so the crew never has to be the last line of defence.
- Replan
- 1 Hz
- Horizon
- 12 s hard, 4 min advisory
- Solver
- Deterministic, bounded time
-
A deliberately narrow interface to the flight control computer. If Decide goes quiet, Command holds the last known safe state, annunciates, and hands the aircraft back in under 200 milliseconds. There is no third option.
- Handback
- < 200 ms
- Bus
- ARINC 429, AFDX
- Assurance
- DAL A
Every command is checked against the envelope first.
Drag the point, or use the two controls. The stack will not issue a command that leaves the shaded region — not at any airspeed, not at any altitude, not under any operator input.
CAS320kt
ALT24 000ft
MACH0.78
MARGIN86kt
Inside envelope — command accepted
Try to leave the region. The commanded point stays where you put it; the aircraft does not.
Certification is not paperwork that follows the work.
It is the artifact.
The evidence is produced by the build, not after it.
Six steps, in this order, every time. Nothing is reconstructed for the audit, because there is nothing left to reconstruct.
- Requirement
Every behaviour begins as a requirement with an owner and an identifier.
- Design
Architecture and interfaces trace to those identifiers in both directions.
- Implementation
Code is generated from, or reviewed against, the design — never around it.
- Verification
Tests are written from the requirement, by someone who did not write the code.
- Evidence
Coverage, traces and reviews assemble into a package on every single build.
- Credit
That package is what the authority reads. It is the same one the engineers read.
DO‑178C DAL A · DO‑254 · DO‑330 · ARP4754A · ARP4761
Where it flies today.
Three platform classes, one stack. The difference between them is how much authority we are given, not how much code is shared.
Rotorcraft
Envelope protection and terrain‑aware routing for single‑pilot IFR. The pilot keeps the controls; the envelope keeps the pilot.
- Airframes
- 3
- Status
- Flight test
- Authority
- Protective
Uncrewed, above 25 kg
Full authority. The ground station is reduced to intent — a destination and a set of constraints — rather than stick and rudder over a link that can drop.
- Airframes
- 40
- Status
- In service
- Authority
- Full
Bring us the hard part of your flight test.
We work with airframers, operators and authorities from requirement zero. A first briefing runs about an hour and we will tell you if we are the wrong fit.